Architecture
The control plane is ours. The data plane is yours.
Migratrix is a cloud application talking to an Executor you deploy next to your databases. Schema work, execution, drift snapshots, and conversion runs on that Executor. The platform stores operational metadata, not your rows and not your connection secrets.
Network
How traffic actually flows
| Path | Direction and purpose |
|---|---|
| Executor → Migratrix | Outbound SignalR over TLS, authenticated with a workspace Executor key. This is how the Executor registers and receives work. No inbound port on your side is required for this path. |
| Platform → Executor | The browser talks to the Executor's public URL over SignalR for live schema, query, and execution. That URL can be an internal address, a custom domain, or {org}.agents.migratrix.com. |
| Executor → your databases | Stays inside your network. TLS to the database when the engine supports it. Credentials never enter the orchestrator database. |
Trust boundary
What never leaves the Executor host
Database credentials
Encrypted at rest on the Executor machine. Rotation is supported without taking the platform down. Optional JIT credentials can come from your own secret manager.
Customer rows
Not copied to Migratrix servers. Transient results used to render Explorer or a diff are processed and discarded.
What the cloud keeps
Users, roles, pipeline definitions, change-script metadata, audit events, Git linkage, and your licence.
Identity
Email and password, SAML SSO, TOTP MFA, and directory import from Google Workspace or Microsoft Entra. GitHub and GitLab OAuth is for repositories, not as the product login.
Deploy where the databases are
One Executor per network segment is the usual shape. Engine plugins install on the Executor, so Databricks ODBC or similar host requirements stay on that machine.
Scoped Executor tokens
Tokens are tied to organisation, workspace, and environment. Executor actions are logged with correlation identifiers in the same audit story as human actions.
Executor host
Bind address, public URL, plugins, and local defaults
| Surface | Default and meaning |
|---|---|
| Bind address | http://0.0.0.0:4002 where the Executor listens on the machine. |
| Public URL | http://localhost:4002 out of the box. Browsers and the platform use this. Production must be HTTPS if the app is HTTPS. |
| Local detection | If Public URL is localhost, 127.0.0.1, or a loopback IP, the platform treats it as local, probes /health with a 2-second timeout, and caches the result for 10 seconds. Localhost TLS can be bootstrapped with mkcert. |
| Install | The Executor settings screen carries Linux and Windows one-liners from get.migratrix.com, plus Docker and Homebrew as documented. Certificate upload lives on that same installation tab. |
| Engine plugins | Installed and reverted on the Executor, optionally signature-verified, staged until restart. An unknown engine type is rejected with a missing-plugin message rather than a generic failure. |
| Rollback knobs on the Executor | Settings include unprotected destructive mode, column-drop protection, global index policy, snapshot schema, pool size, and timeouts. These are operator controls, not per-script checkboxes. |